100 likes | 266 Views
Understanding Information Security . ISO 17799 / BS7799. Adaptive Processes. Just Imagine…. What will happen if our current office can’t be used for few days because of fire? What will happen if our competitor hacks into our network and gets all sensitive information?
E N D
Understanding Information Security ISO 17799 / BS7799 Adaptive Processes Simpler, Faster, Better
Just Imagine… • What will happen if our current office can’t be used for few days because of fire? • What will happen if our competitor hacks into our network and gets all sensitive information? • Our communication link to our customer goes down for prolonged period? • And many more….. Simpler, Faster, Better
So The Implications Are… • Information security is essential to maintain competitive edge, cash-flow, profitability, legal compliance and commercial image • It is extremely critical for us to identify, assess and take preventive / corrective measures for risks that our business faces • It is legally required to protect information that customers provide us Simpler, Faster, Better
Global Information Village Simpler, Faster, Better
Information Criticality Basic Operations Business Reflexes Strategic Thinking Digital Nervous System Customer Interaction Information systems are nervous system of an information enterprise - Failure of nervous system indicates failure of the organization Simpler, Faster, Better
Understanding Information Security • Confidentiality • Ensuring that information is accessible only to those authorized to have access • Integrity • Safeguarding the accuracy and completeness of information and processing methods • Availability • Ensuring that authorized users have access to information and associated assets when required Simpler, Faster, Better
TECHNOLOGY TECHNOLOGY Securing Information ATTACK ATTACK POLICIES PROCESSES STANDARDS TRAINING ATTACK ATTACK HUMAN FIREWALL HUMAN FIREWALL ATTACK ATTACK INFORMATION ATTACK ATTACK ATTACK ATTACK Simpler, Faster, Better
Introducing ISO 17799 • Provides recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization • Provides a common basis for developing organizational security standards and effective security management practice and to provide confidence in inter-organizational dealings Simpler, Faster, Better
What it is: An internationally recognized structured methodology dedicated to information security A defined process to evaluate, implement, maintain, and manage information security ISO 17799 What it is not: • A technical standard • Product or technology driven • An equipment evaluation methodology such as the Common Criteria/ISO 15408) Simpler, Faster, Better
What it is: A comprehensive set of controls comprised of best practices in information security Developed by industry for industry ISO 17799 What it is not: • Related to the "Generally Accepted System Security Principles," or GASSP • Related to the five-part "Guidelines for the Management of IT Security," or GMITS/ISO TR 13335 Simpler, Faster, Better